CLAIMS 



[d] A method in a computer system for assessing risk of a project, the method 

comprising: 

for each of a plurality of risk types, 

providing rules for one or more risk factors for determining whether 
each risk factor is high; and 

providing one or more mitigating factors for a risk factor; 

receiving information describing the project, the information including data 
relating to each risk type; 

for each of the plurality of risk types, 

identifying risk factors that have a high risk by applying the provided 
rules to the data for the risk type; and 

identifying mitigating factors that apply to the identified risk factors; 
and 

generating a risk assessment report that includes the identified risk factors 
and identified mitigating factors. 

[c2] The method of claim 1 wherein the information describing the project 

includes overall project information and detailed project information. 

[c3] The method of claim 1 wherein the provided rules are provided by software 

that implements each rule. 
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[c4] The method of claim 1 wherein the provided rules are provided by a rules 

engine that applies rules from a rules table. 

[c5] The method of claim 1 wherein indications of the identified risk factors and 

identified mitigating factors are persistently stored. 

[c6] The method of claim 5 including receiving an analysis of the identified risk 

factors and mitigating factors for a risk type from a user designated to provide 
analyses for that risk type. 

[c7] The method of claim 6 wherein the generated risk assessment report 

includes the received analysis. 

[c8] The method of claim 1 including receiving auxiliary data for a risk type. 

[c9] The method of claim 8 wherein the generated risk assessment report 

includes the received auxiliary data. 

[do] The method of claim 8 wherein the auxiliary data is in a spreadsheet 

format. 

[cii] The method of claim 8 wherein the auxiliary data is in a graph format. 

[d2] The method of claim 1 wherein the project is defined by a proposed 

contract. 

[d3] A computer system for assessing risk of a project, comprising: 

a rules component having rules for risk factors for determining whether 
each risk factor is high and having mitigating factors for a risk factor; 
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a data input component that receives information describing the project, the 
information including data relating to the risk factors; and 



an analysis component that identifies risk factors that have a high risk by 
applying the rules to the data and that identifies mitigating factors 
that apply to the identified risk factors. 

[d4] The computer system of claim 13 including a report component that 

generates a risk assessment report listing the identified risk factors and the 
identified mitigating factors. 

[ci5] The computer system of claim 13 wherein the information describing the 

project includes overall project information and detailed project information. 

[ci6] The computer system of claim 13 wherein the rules are provided by 

software that implements each rule. 



[d7] The computer system of claim 13 wherein the rules are provided by a rules 

engine that applies rules from a rules table. 

[ci8] The computer system of claim 13 wherein indications of the identified risk 

factors and identified mitigating factors are persistently stored. 



The computer system of claim 18 wherein the risk factors and mitigating 
factors are categorized by risk type and including an analyst component that 
receives an analysis of the identified risk factors and mitigating factors for a risk 
type from a user designated to provide analyses for that risk type. 

The computer system of claim 19 wherein the received analysis is included 
in a risk assessment report that lists the high risk factors and mitigating factors. 
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[c2i] The computer system of claim 13 including a component that receives 

auxiliary data for a risk type. 

[c22] The computer system of claim 21 wherein the received auxiliary data is 

included in a risk assessment report that lists the high risk factors and mitigating 
factors. 

[c23] The computer system of claim 21 wherein the auxiliary data is in a 

spreadsheet format. 

[c24] The computer system of claim 21 wherein the auxiliary data is in a graph 

format. 

[c25] The computer system of claim 13 wherein the project is defined by a 

proposed contract. 

[c2 6] A computer-readable medium containing instructions for controlling a 

computer system to assess risks of a project, by a method comprising: 

for each of a plurality of risk types, providing rules for one or more risk 
factors for determining whether each risk factor is high; 

receiving information describing the project, the information including data 
relating to each risk type; 

for each of the plurality of risk types, identifying risk factors that have a 
high risk by applying the provided rules to the data for the risk type; 
and 

generating a risk assessment report that includes the identified risk factors. 
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[c27] The computer-readable medium of claim 26 wherein the information 

describing the project includes overall project information and detailed project 
information. 

[c28] The computer-readable medium of claim 26 wherein the provided rules are 

provided by software that implements each rule. 

[c29] The computer-readable medium of claim 26 wherein the provided rules are 

provided by a rules engine that applies rules from a rules table. 

[c30] The computer-readable medium of claim 26 including identifying mitigating 

factors that apply to the identified risk factors wherein indications of the identified 
risk factors and identified mitigating factors are persistently stored. 

[c3i] The computer-readable medium of claim 30 including receiving an analysis 

of the identified risk factors and mitigating factors for a risk type from a user 
designated to provide analyses for that risk type. 

[c32] The computer-readable medium of claim 31 wherein the generated risk 

assessment report includes the received analysis. 

[c33] The computer-readable medium of claim 26 including receiving auxiliary 

data for a risk type. 

[c34] The computer-readable medium of claim 33 wherein the generated risk 

assessment report includes the received auxiliary data. 

[c35] The computer-readable medium of claim 33 wherein the auxiliary data is in 

a spreadsheet format. 
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[c36] The computer-readable medium of claim 33 wherein the auxiliary data is in 

a graph format. 

[c37] The computer-readable medium of claim 26 wherein the project is defined 

by a proposed contract. 
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